CVE-2026-63336: RabbitMQ Java client insecure default TLS certificate validation

CVE-2026-63336 · Severity: medium · CVSS 4 · Published 2026-08-18

The RabbitMQ Java client library uses an insecure default trust manager that accepts any TLS certificate—including self-signed and null certificates—when calling useSslProtocol() without arguments. Combined with disabled hostname verification by default, this enables attackers to intercept all communication via man-in-the-middle attacks. Additionally, the library defaults to plaintext connections and can expose credentials in logs and over the network when using basic authentication.

Technologies: com.rabbitmq:amqp-client (Maven), RabbitMQ Amqp-Client. Vendors: Maven, RabbitMQ.

Quick answers

Is CVE-2026-63336 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63336 being exploited in the wild.
How severe is CVE-2026-63336?
Medium severity, with a CVSS score of 4, published 18 August 2026.
Which products and versions are affected?
com.rabbitmq:amqp-client (Maven) < 5.33.0, ECOSYSTEM:introduced=0,fixed=5.33.0; RabbitMQ Amqp-Client < 5.33.0.
Is there a fix for CVE-2026-63336?
Yes. com.rabbitmq:amqp-client (Maven): upgrade to 5.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63336 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63336?
Check whether you run com.rabbitmq:amqp-client (Maven) or RabbitMQ Amqp-Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.rabbitmq:amqp-client (Maven): upgrade to 5.33.0 or later
    # set com.rabbitmq:amqp-client to 5.33.0 in your pom.xml or build.gradle

Technical details

The vulnerability stems from improper certificate validation (CWE-295). The com.rabbitmq.client.TrustEverythingTrustManager class accepts any TLS certificate without validation, and is used as the default when calling ConnectionFactory.useSslProtocol() without arguments. Additionally, hostname verification is disabled by default, requiring explicit enableHostnameVerification() calls. The library defaults to plaintext port 5672 instead of encrypted port 5671, and the getPassword() method returns plaintext credentials without redaction, exposing them in logs and stack traces. Exploitation requires network access to the RabbitMQ server and no authentication is required to perform MITM attacks. An attacker can present a self-signed certificate to intercept all traffic, steal credentials, or perform DNS rebinding attacks. The patch is available in version 5.33.0 and later.

Affected products

  • RabbitMQ amqp-client < 5.33.0

Identifiers

  • CVE-2026-63336
  • GHSA-5m9f-rphj-c435

Timeline

  • 2026-08-18: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-08-18: patched: Patch released in version 5.33.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.